ccdef7651a98e4679187eed80bea87f405d14cfd1fe4daaa259f36f47c00b9de

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2024, 16:24

Target
Steam/PDFL.dll
Size 4.4MB
Sample240706-twk4fsxcna
SHA256 3181deca6bb6c45cfe4be3e7ec2450151b944b9af5350892707dac85071f1d46
MD5 67bb54f9cb4bd8818483c3d71c61d43b
SHA1 e1c0c027032113de8c7825330b242cadbafd2d68
SHA512 964360c7f9ddc651d4f78136904844b8cb4ae3da5f4d30e83d126ea0074b391bcd79ffcb0bf005fc7ac1d63922e6af96a970bdfa6922841305c78cbd504c651e
SSDEEP 98304:IB6Tao2g69wik9QH+xMFr7Bi/GqBulQLjZRYeAlE2ZH:VaHeikPmdBeGqIaZRYpD
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3636 wrote to memory of 2720	3636	rundll32.exe	84
PID 3636 wrote to memory of 2720	3636	rundll32.exe	84
PID 3636 wrote to memory of 2720	3636	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Steam\PDFL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3636
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Steam\PDFL.dll,#1
  2⤵
  PID:2720